916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5

General

Target

916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Size

2.5MB
MD5

52f0beb4bc05d14654c718f035926e62
SHA1

36db183bf9e2667d5b71bb9ff381e654d357e01d
SHA256

916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5
SHA512

56bfd419b6692242b452e257ed0ea0b956a8639bc7ad56169ecb822bb6b1412fe7f22ed786042f7e09ae024eb071214722f2f1a0e7199a5414ea87960a151fe5
SSDEEP

49152:LWBj/cZ6dm/O6ytbioxX6ZPSVbINZ9JyKEOL6+mD8OUgt1w:9p//yxxXK6Gn9J9hL6VQNgt1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2904	sg.tmp

Loads dropped DLL 3 IoCs

pid	Process
3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
2904	sg.tmp

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/2736-8-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/2736-11-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-31-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-32-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-33-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-35-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-37-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-38-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-39-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-40-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-41-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-42-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-43-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-44-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-45-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-46-0x0000000000400000-0x00000000005FB000-memory.dmp	upx
behavioral1/memory/3024-47-0x0000000000400000-0x00000000005FB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sg.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeBackupPrivilege	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeRestorePrivilege	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeBackupPrivilege	2736	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeRestorePrivilege	2736	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	2736	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	2736	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: 33	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeIncBasePriorityPrivilege	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
Token: SeRestorePrivilege	2904	sg.tmp
Token: 35	2904	sg.tmp
Token: SeSecurityPrivilege	2904	sg.tmp
Token: SeSecurityPrivilege	2904	sg.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	sg.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2812	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	30
PID 3024 wrote to memory of 2812	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	30
PID 3024 wrote to memory of 2812	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	30
PID 3024 wrote to memory of 2812	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	30
PID 3024 wrote to memory of 2736	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	32
PID 3024 wrote to memory of 2736	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	32
PID 3024 wrote to memory of 2736	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	32
PID 3024 wrote to memory of 2736	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	32
PID 3024 wrote to memory of 2904	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	33
PID 3024 wrote to memory of 2904	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	33
PID 3024 wrote to memory of 2904	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	33
PID 3024 wrote to memory of 2904	3024	916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe	33

C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
"C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1553408 -len=1086808 "C:\Users\Admin\AppData\Local\Temp\~3870384091315519643.tmp",,C:\Users\Admin\AppData\Local\Temp\916ea29028c52f1220e8f4b7dea3e8242e0a59e05bd44f54dbc61ea37aea6ed5.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\~5814762324030851387~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~3870384091315519643.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~2636402222801963748"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~3870384091315519643.tmp

Filesize
1.0MB

MD5
de0fbe94c4b601b03782d5f7bfb6bf0b

SHA1
66a012bdcf47c9245807126fcb74cce66354d37b

SHA256
0631923c95b63e0ff0df0fce1be0f67e291e36f57565965527f46201c406e34e

SHA512
050bc9ca755356b9b19cfdb0fb09b31b2385c7967a39e653d617de8645d20751494120251708f0a696ca720a771b5737ca286bd62db3ca5b337a688bbc17f7b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~5814762324030851387~\7z.dll

Filesize
1.1MB

MD5
4a224bc36119d0a9b3f862edefc9a91a

SHA1
fcd584077825f86a27e7a8575c4cd971ddecd387

SHA256
b339f59e151cdc460d944b59ad92b4f33e6be148b72c23e116fcc47ebabb1575

SHA512
1e27c150976bbcc05f3d118f9bcdd0a5f61e1fdcc5a57387261c87fa2d2c2bf817cd93510c6eff504e10cc099389e8acbe9ceb543c9515edce3249409af22a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~5814762324030851387~\sg.tmp

Filesize
415KB

MD5
5e397bb9f0fe8b98104f1c124435c936

SHA1
08fca294ed1c828ca796930d0457f2d7d2896a31

SHA256
338600eeede3179be5666dd49e4998cf7993db9bc16c5b8ac9cfaffaae260579

SHA512
7ba684daab5cba6993c0b20883db19b0468a56dcc7fde406fbe47256e7e90668911742ad43077e3cbedb190931018b65428d45ebef81cbba092789553fbeb06c

Download Submit
memory/2736-8-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/2736-11-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-36-0x0000000002220000-0x0000000002320000-memory.dmp

Filesize
1024KB

Download
memory/3024-37-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-30-0x0000000002220000-0x0000000002320000-memory.dmp

Filesize
1024KB

Download
memory/3024-31-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-32-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-33-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-34-0x0000000002790000-0x000000000298B000-memory.dmp

Filesize
2.0MB

Download
memory/3024-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-35-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-7-0x0000000002790000-0x000000000298B000-memory.dmp

Filesize
2.0MB

Download
memory/3024-38-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-39-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-40-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-41-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-42-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-43-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-44-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-45-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-46-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/3024-47-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing